Hidden-code voting and marking systems

ABSTRACT

A paper ballot voting system is described that allows voters to verify that their ballots are correctly counted and provide substantiating evidence if they are not. The systems work whether or not automation is available in the polling place. In other aspects special pens and printing provide protection of voter privacy and against marks being added after ballots are cast. Further aspects of the approach include robust ballot scanning and improved transparency of the voter check-in process.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation-in-part of PCT/US09/01339 filed Mar.3, 2009 and claims priority from U.S. patent application Ser. No.11/519,709 filed Sep. 11, 2006 under 35 U.S.C. 120, the US applicationbeing incorporated herein in its entirety by reference. The presentapplication also claims priority from two United States ProvisionalApplications, by the present applicant, titled “ScratchTegrity VotingSystems, U.S. PTO 61/033,179, filed Mar. 3, 2008, and titled “Mark countand unpredictable choice in voting systems,” U.S. PTO 61/088,046, filedAug. 12, 2008. The following are hereby included by reference in theirentirety: US patent application entitled “Ballot integrity systems,”publication number 2007/0095909, filed May 3, 2007; and US patentapplication “Scan-Integrity Election Systems,” application Ser. No.12/219,034, filed Jul. 15, 2008.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates generally to secure document systems, andmore specifically to marking and processing in such systems such as forelections.

The majority of voting systems in the majority of democracies around theworld are based on paper ballots that are marked by voters. Lack ofconfidence among at least some voters in the integrity of vote countingin a number of these elections has, however, diminished voterparticipation and caused various other significant problems. A way toimprove transparency of paper-ballot elections, ideally allowing votersto ensure that their own votes are correctly recorded and that recordedvotes are correctly included in the final tally, without diminishing thesecrecy of votes or increasing the ease with which voters can beimproperly influenced in their voting, would accordingly beadvantageous. Related aspects include robust mark recognition,prevention of marks from being added to already cast ballots, receiptprinting, check-in procedure transparency, and secure auditing, whichwould also be advantageous.

Earlier Scantegrity systems, published descriptions of which have beenincluded by reference here in their entirety above, required the voterto fill an oval at a ballot position and optionally to note a symbolsuch as a letter typically printed next to the oval. An online check bya voter based on an identifying number allowed the voter to verify thatthe letters that the voter previously noted were in fact postedcorrectly. A voter could then report any mismatch. If a voter were toreport a mismatch in these earlier systems, however, the physical ballotwas to be located as part of the solution to resolving the dispute. Thisstep of locating and inspecting an already cast ballot, particularly inthe case of false or nuisance reports, is believed undesirable in somesettings, owing to such factors as the cost and time involved andpotential privacy risk. It is accordingly desired to substantially atleast reduce such locating and inspecting of cast ballots.

Earlier systems, such as those described in co-pending applications bythe present applicant included herein in their entirety above and inBenjamin Adida's MIT Ph.D thesis titled “Advances in CryptographicVoting Systems” from 2006, have contemplated the use of scratch-off invarious ballot arrangements without addressing this problem.

The present invention aims, accordingly and among other things, toprovide secure, privacy-protecting, reliable, and useable electionsystems and non-election marking systems generally. Objects of theinvention also include addressing all the above mentioned as well asgenerally providing practical, useable, robust, efficient, low-costsystems. All manner of apparatus and methods to achieve any and all ofthe forgoing are also included among the objects of the presentinvention.

Other objects, features, and advantages will be more fully appreciatedwhen the present description and appended claims are read in conjunctionwith the drawing figures.

BRIEF DESCRIPTION OF THE DRAWING FIGURES

FIG. 1 shows a combination flowchart and cryptographic protocol diagramof an exemplary embodiment of an overall voting system aspect inaccordance with the teachings the invention.

FIG. 2 shows a protocol diagram of an exemplary cryptographic commitmentsystem in accordance with the teachings of the invention.

FIGS. 3A-B show plan views of detailed exemplary embodiments ofscratch-off ballots in accordance with the teachings of the invention.

FIGS. 4A-B show plan views of exemplary embodiments of invisible inkballots in accordance with the teachings of the invention.

FIGS. 5A-D show plan views of exemplary mark position printing inaccordance with the teachings of the invention.

FIGS. 6A-D show plan views of de-identifying and de-identified ballotsand delayed counterfoils in accordance with the teachings of theinvention.

FIGS. 7A-C show detailed exemplary embodiments of pre-filled positionsin accordance with the teachings of the invention.

FIG. 8 shows plan views of exemplary embodiment of pre-filled positionpatterns in accordance with the teachings of the invention.

FIGS. 9A-C show plan views of detailed exemplary embodiments ofpre-filled coded position forms in accordance with the teachings of theinvention.

FIGS. 10A-C show combination flowchart and block diagrams of exemplaryembodiments of pre-filled positions and related systems in accordancewith the teachings of the invention.

FIGS. 11A-D show combination plan and schematic views of an exemplaryfade-out invisible ink system in accordance with the teachings of theinvention.

FIGS. 12A-D show combination plan and schematic views of exemplaryfade-in invisible ink systems in accordance with the teachings of theinvention.

FIGS. 13A-B show combination block and flowchart diagrams of exemplaryfading invisible ink systems in accordance with the teachings of theinvention.

FIGS. 14A-D show plan views of exemplary embodiments of ballot formsproviding mark count contests in accordance with the teachings of theinvention.

FIG. 15 shows a flowchart of an exemplary embodiment of a mark countcode receipting scanner in accordance with the invention.

FIG. 16 shows a section of a diversified marking device in accordancewith the teachings of the invention.

FIGS. 17A-B show combination flowchart and block diagrams of pendiversification systems in accordance with the teachings of theinvention.

FIG. 18 shows a plan view of an exemplary embodiment of a frozen ballotin accordance with the teachings of the invention.

FIGS. 19A-B show combination flowcharts and block diagrams of exemplaryembodiments of freezing against undetectable post casting marking inaccordance with the teachings of the invention.

FIG. 20 shows a combination block diagram and flowchart of an exemplaryembodiment of an audit choice commit system in accordance with theteachings of the invention.

FIG. 21A-B show combination section and schematic views of exemplaryembodiments of indelible marking buttons in accordance with theteachings of the invention.

FIG. 22 shows a flowchart of an exemplary embodiment of unpredictableballot differentiation in accordance with the teachings of theinvention.

FIGS. 23A-B show plan views of exemplary embodiments of scratch-offpaired check-in forms in accordance with the teachings of the invention.

FIGS. 24A-B show plan views of exemplary embodiments of invisible-inkpaired check-in forms in accordance with the teachings of the invention.

FIGS. 25A-B show combination block-diagram and flowcharts of exemplaryembodiments of a voter-verifiable counter system in accordance with theteachings of the invention are shown.

BRIEF SUMMARY OF THE INVENTION

This section introduces some of the inventive concepts in a way thatwill readily be appreciated, but that may make significantsimplifications and omissions for clarity and should accordingly not betaken to limit their scope in any way; the next section presents moredetailed descriptions.

A voter “fills the ovals” on a ballot form using a pen that contains adeveloper ink so that certain “codes” printed in invisible ink on theform in the positions marked are then developed and revealed to thevoter. The voter is preferably allowed to note the codes revealed, suchas by writing them on paper provided for this. Later the voter maychoose to look up the ballot by serial number to see whether the codeswere correctly published. If the voter finds that the published codesdiffer from those noted, then the noted codes serve as an evidentiarybasis for the filing of a dispute by the voter.

In advance of the election, cryptographic commitments are published bythose running the election that determine but do not reveal the codesand the votes that they will correspond to. After the election thoserunning the election preferably provide what is in effect a so-called“cryptographic proof” that the published codes result in the tally in away that is consistent with the originally published commitments. Allcodes for the disputed ballots can be revealed, proving definitively iferror complaints by voters are invalid. If enough complaints are notdisproved in this way, the election results may be called into question.

Some inventive aspects provide secure, private and reliable printing foruse in such elections. By printing invisible inks and dummy inks inpatterns that hide coded information, simply being able to detect thepresence of ink is not enough to read the hidden information. To protectprivacy, information is hidden or revealed with delay after a developeris applied and other information is physically removed from ballots. Sothat the addition of marks on already cast ballots would be revealed byforensic analysis, the pens used are preferably chosen from sets ofdifferent pens or pens that change their marks as they are used orprocesses are applied to ballots during casting. Also, voters can marktheir ballots with counts of votes so that marks added after castingwould invalidate the ballot. To allow auditing at the time ballots arecast, voters provide commitments in advance of marking as to whetherthey wish to audit or vote and printers commit to vote data beforevoters decide whether to see that data or cast the ballot. By voting arandom choice in effect on a special contest, a secure online counter ofthe number of votes cast is optionally provided.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

Detailed descriptions are presented here sufficient to allow those ofskill in the art to use the exemplary preferred embodiments of theinventive concepts.

In one aspect of the present invention, the indicia, referred to here asa “code” or “value,” that is printed for each location that can bemarked on a paper form or that becomes visible when the position isselected, or what will be referred to generally here as “marked,” ispreferably chosen from a set, called here a “code set.” Such a positionwill be considered initially “unmarked” until the person “marks” itusing what will generally be referred to as a “pen” which will beunderstood to be any marking means. What will be referred to here as“hidden” codes or values are any that are printed or otherwise formedinto the ballot object in such a way that they are not readily learnedby a voter without the voter marking them and leaving evidence of somarking. When a voter marks a position, a code corresponding to thatposition is “revealed” and made at least potentially readable to orotherwise known to a voter. The “mark positions” or simply “positions”on a ballot or other form are here understood to be the locations orregions on the form that can be selected and marked to indicatedifferent choices by the person filling the form. What will here becalled “vote choice positions” are positions that correspond to actualvotes by voters, such as for candidates or on ballot questions.

A “proffered code,” as the term will be used here, is a code value thatis claimed to have been seen on a ballot and that differs from thatofficially posted as what was found on a ballot corresponding to aposition as marked on the ballot. A proffered code is applicable, orwhat will be called here “limited,” to for example a particular set ofballots and/or contests and more generally a set of positions on ballotscalled here the “indicia instances.” For example, a proffered code maybe associated with a particular ballot serial number and a particularcontest within that serial number and the relevant indicia instanceswould then be the indicia printed on that particular ballot under thatcontest. In another example, a proffered code may correspond to indiciainstances that are in a particular contest on all ballots, such as inthe case where there are no serial numbers on ballots. In still furtherexamples, a proffered code is limited to indicia instances of ballotscast in a particular precinct. In these examples the code set ispreferably associated with the indicia instances and preferably nomember of the code set appears printed more than once among the indiciainstances.

Accordingly, in a system with sparse code sets that remain hidden untilmarked, it will be appreciated that an allegation of improper postingrelated to a particular proffered code is more convincing if thatproffered code is revealed prior to the release if any of the indiciainstances apart from the subset that are published as marked. As oneexample, proffered codes are received and posted by a cut-off point andthen commitments to the used codes are opened. (The term “commitment” asused herein will be understood to mean the type of cryptographiccommitment known in the art and as for example described in the includedreferences as well as physical commitments, such as those made byplacing a value in an envelope.) As another example, proffered codes areshown to be invalid by a “cryptographic proof” that does not reveal theindicia instances. For those unvoted ballots called here “audited”ballots, the printed codes are optionally released without delay.

Some example scenarios will now be described, as will be appreciated, soas to provide further understanding of the applicability of theinventive concepts. If ballot forms have no serial numbers but do haveprecinct numbers (limiting them to about a thousand ballots of a dozenor so positions each) and the code set is about seven alphanumericdigits like with airline record locator numbers, and the number ofproffered codes is kept to less than a thousand (such as by requiringpersonal appearance or affidavits), then it is believed that the chanceof a guessed code proffered being among the indicia instances issubstantially small. As another example, ballots have serial numbers andindicia sets comprise about ten elements, so even a match of a smallnumber of proffered two character codes may it is believed bestatistically significant, if the number of proffered codes is kept toat most a few per indicia instance (such as by requiring one of a fewcandidates, parties or other organization to stand behind unique codes).

The method of a election disclosed can optionally be considered in anaspect as further extended for example to include cryptographicselection of the indicia, printing hidden forms of the indicia on theballots, revealing the printed indicia by voters in marking, and thedispute resolution procedure requiring the proffered codes to be madeknown by the voter before commitments to the indicia codes are opened orotherwise used in proof by those running the election. If voters proffercodes not posted but in the corresponding indicia set in substantiallymany instances and/or against substantially large odds, then a physicalaudit of the paper ballots is preferably called for and/or the electionre-run. Such proffered codes that are not shown to be absent from thecode set are here called “evidence” of possible error or malfeasance.The evidence is considered probabilistic in the sense that it could haveresulted from chance or guessing on the part of voters; however, whenthe probabilities are such that there is a substantial statisticalconfidence for the setting, such as for instance 99 percent, then thevalues are called “probabilistic evidence.” Counterfoils optionallyretained by voters would provide “physical evidence” of substitutedforms during an audit.

Turning now to FIG. 1, a combination flowchart and cryptographicprotocol diagram of an exemplary embodiment of an overall voting systemaspect in accordance with the teachings the invention is shown. As willbe appreciated, a particular exemplary arrangement of possible groupingsof steps and their interrelations is shown here for clarity, but withoutany limitation. Some aspects of so-called cryptographic voting systemsknown in the art or disclosed in co-pending applications included hereby reference are not described for clarity in the description of thepresent systems but are implicit as would be understood by those ofskill in the art. Examples of such aspects include the overallcommitment to printing and releasing of results and handling ofprovisional ballots and audits.

After start 110, the first step indicated in the example arrangement isrepresented by the “commit to codes” box 120. The codes that voters willsee on their ballots for positions that they mark are first determined,preferably at least in a cryptographic and/or random manner so as to besubstantially unpredictable (but optionally satisfying certain rules asmay be desired such as for usability) and information is published thatpreferably represents what is generally referred to as a “cryptographiccommitment” to the codes. In some examples, such as will be describedwith reference to FIG. 2, this comprises a kind of encryption of eachcode, such as using one of the well know “commitment schemes” of thecryptographic art. As will be appreciated, however, there are many waysto “commit” to data and to provide possibilities for selectively“opening” the commitments to reveal and/or demonstrate properties ofdata content so committed to. In examples where the individual codesthemselves are separately committed to and then will be opened later, aswill be described with reference to FIG. 2, it is believed advantageousto order or otherwise structure the commitments in a way that does notreveal the candidate corresponding to each. For instance, a randomlyordered vector or set of commitments for a particular contest on aparticular ballot can all be opened if desired later withoutcompromising voter privacy but still establishing which codes werevalid.

Dashed box 130 depicts a next major phase of the election, that ofvoting. Various parts of this example grouping are performed in a seriesor in a more intermingled fashion, depending on the setting. Forinstance, ballots can all be printed in advance or demand printed forsome or all voters. As another example, audit of printing is preferablyaccomplished immediately at the polling place when the voter obtains aspoilt ballot or it can be performed before the polls open or after theyclose by voters and/or auditors as will be described later. Accordingly,for clarity an example ordering will be described without anylimitation.

Box 132 is the printing of ballots. In some examples this isaccomplished by ink-jet printing using multiple inks as will beunderstood in view of the ballot forms described with reference to FIG.3 through FIG. 5. All manner of technique for packaging and distributingballots are known in the election art.

Box 1034 indicates that voters are able to learn codes corresponding tothe positions marked. This is accomplished through the use ofscratch-off or invisible ink or other techniques, such as includingthose described in more detail elsewhere here including with referenceto FIG. 3 through FIG. 5.

Box 136 is the actual casting of ballots by voters. Until a ballot iscast, voters are generally permitted to “spoil” the ballot and tryagain, at least up to some limits Casting differs per voting setting,some of which are described as illustrations: With so-called precinctscan, ballots are scanned at the polling place, affording voters andoption to be informed of errors or other aspects of the scanner'sinterpretation of their ballot before taking the decision to cast it. Ina manual polling place, such as without a scanner, casting may literallybe by inserting the form into a box for later hand counting and/orscanning centrally. In a vote by mail system, mailing the ballot may beregarded as casting. For a so-called provisional ballot, the casting canbe considered to take place later after the decision to count theparticular ballot is made.

To the extent that ballot casting entails scanning of forms, box 136reflects methods and structure to scan and look for positions markedand/or positions not marked. In particular, the case as described withreference to FIG. 7 through FIG. 10 is anticipated where all positionsare to be recognized by the scanning algorithm, whether they are markedor not marked.

Box 138 is the audit of printing. A variety of techniques for this areknown in the art. For instance, voters once given a ballot to vote maydecide to spoil it and take it home to look up online. The forms thatleave the polling place are preferably substantially irreversiblymodified (so that they are not readily re-introduced as voted ballots),such as by punching a hole, removing a counterfoil (including removinginformation yet developed, as will be described with reference to FIG.6), or tearing from a locked holder. The system should, once a ballot isknown to be spoilt, post substantial data related to that ballot, aswill be described further with reference to FIG. 2. For example, what isposted preferably includes sufficient data to allow checking that whatwas supposed to be printed was in fact printed. Other data can bereleased conveniently, as is known in many systems, that does notcompromise other ballots or aspects of the system and allows, forinstance, consistency checking of commitments made earlier, such as inbox 120 and other commitments as are known in such systems.

Dashed box 140 depicts a further major phase of the election, that ofchecking by voters. As indicated, this step preferably does not revealthe correspondence between votes and codes, such as would be revealed bya linking between ballot serial numbers and votes. (The votes themselvesmay be revealed before, during or after this phase, as is known forother cryptographic voting systems and not shown here for clarity.) Itis believed that in many settings this phase is at the option of votersto participate in; however, in some settings, intermediaries, such aspolitical parties or other groups may participate and increase theeffective level of voter checking. In some example, the information ismade public and challenges occur subsequently, and this arrangement isshown for clarity. However, other examples include cooperation betweenthese aspects. For instance, a setting in which codes are not postedinitially but rather made available in exchange, such as using aso-called “exchange of secrets” cryptographic protocol, for what thevoter believes the codes should be. One example arrangement is describedhere for clarity.

Box 144 is the posting by those running the election of the codes votedfor by voters. One way these codes are obtained, in some examplesystems, is by scanning the actual ballot and applying so-called OCR orthe like to recover the codes visible. Another example, also to bementioned with reference to FIG. 2, takes the votes associated with acorresponding serial number (or in some examples sets of such numbers)and looks up the codes, such as using secrets that were used in formingthe commitments.

Box 148 is the so-called “proof” by the system of whether particularcodes proffered by voters would have appeared on ballots. Putdifferently, the system can debunk many attempts to falsely incriminateit that falsely claim that the codes shown on the ballot differ fromthose posted. As will be understood, this is by a kind of cryptographicproof or argument that relates to the commitments already mentioned withreference to box 120. Of course, it may happen that some codes wereamong those that were to be printed and the proffered codes cannot bedebunked in this way but may be debunked by physical ballot audit orignored if they are too few or likely to have been obtained by chance.

Box 150 finally is the manual audit of ballots, the last step shownbefore the election end 160. As has been mentioned, one believed benefitof the codes remaining hidden for unvoted positions is that it isbelieved to reduce or eliminate the need for manual audit of particularballots. When such audit is to be performed, however, it can be. Oneexample is the original scantegrity approach, as is known in the art anddisclosed elsewhere. Other approaches are optionally allowed by thehidden codes. For example, a series of holes and a larger hole can bealigned with the ballot in an unpredictable way for each round and thevoter allowed to choose one of the holes to open. For instance, the rowof holes can align with the codes but be shifted so that opening onehole will reveal a code or some other region of the ballot, such asanother contest. In case it is another contest, the additional holes maybe opened to substantiate the valid positioning of the holes. Theprocedure can be repeated any number of times, so that all the codes arerevealed with adequate certainty, but which code corresponds to whichvote is not revealed.

In some exemplary embodiments manual audit would not be used, at leastif there were no statistically significant evidence of substantialmalfeasance or sufficient malfeasance to cause changes in the results.One example way to allow shorter codes to still provide substantialresistance to a kind of flooding of many guessed codes per ballot is an“authentication code,” such as additional digits printed with the serialnumber. If the voter feels that the wrong code was posted, the voter canprovide the additional digits, preferably through some sort of exchangeprotocol. For instance, the authentication code along with the profferedcode and serial number and contest indication are provided by the voterfor a so-called “blind signature” to be formed by those running theelection. The type of signature preferably includes the time. Then thevalues are opened or otherwise shown to be the same or shown to differfrom those proposed by the voter through a suitable cryptographicprotocol as would be understood by those of skill in the cryptographicart. One example way to prevent cheating by those running the electionthat provides such authentication codes to block their use by voters isa procedure for providing them, such as in person or in two phases, oneof which is online, but the second of which is in person for disputedvalues. Each phase uses a part of the authentication code.

Turning now to FIG. 2, a protocol diagram of an exemplary cryptographiccommitment system is shown in accordance with the teachings of theinvention. It presents a very basic example of a particular way toconstruct the system, for clarity, but without limitation whatsoever, aswill be understood by those of skill in the art. The rectanglesrepresent commitments, such as encryptions or the results of so-called“cryptographic commitment schemes.” The arrows are in effect pointers orindexes of the elements of the next column that are contained within thecommitment of the preceding column. The columns are labeled across thetop.

The column labeled “printing” comprises commitments grouped publicly byballot serial number, as indicated by the example serial number “#3834”shown. There would of course be many such ballots arranged verticallyeach with a different serial number, not shown for clarity. The nextcolumn is similarly grouped by serial number as shown. The order of theelements is hidden by the preferably substantially random orcryptographic pseudorandom permutation shown by the crossing pattern ofthe arrows. Inside this column, labeled “codes,” are the actual indiciacodes that should be printed next to the corresponding candidate of theprinting column. Also in each of these elements is a pointer to anelement of the next column. The “intermediate” column contains elementsoptionally not grouped by serial number but ranging over all the serialnumbers. The ellipsis and spacing and the permutation of the arrowsindicates that these are in a substantially random or unpredictableorder, as are the elements of the next table, the “results” columns.This final column is grouped vertically by candidate as labeled.

When a ballot is spoilt and to be opened in audit all the pointers inthe leftmost column corresponding to its serial number are first opened.Then the pointers contained are followed, the elements pointed toopened, the pointers followed, the elements opened, the pointersfollowed, and the final results column elements opened. The codes shouldbe checked to have been printed next to the candidates that they areconnected to and each code should be connected to the same candidate inboth directions.

When a mark is scanned but the code is not OCR'ed, the code can be foundby those running the election following the pointer in the correspondingelement in the first column. When the code is OCR'ed those running theelection know which commitment contains that element and whichcommitment in the intermediate and final columns with which itcorresponds. In either case the corresponding intermediate element andresults element are marked publicly when the results are released. Arandom challenge, as is known, is then used to select which side of themarked intermediate cells should be opened, forwards or backwards, as isin known systems and/or systems disclosed by the present applicantincluded here by reference.

If a code is proffered associated with a particular serial number, thenall those elements in the second column are opened to reveal the codesused and to show presumably that the proffered code is not a valid code.

Turning now to FIG. 3A-B, plan views of detailed exemplary embodimentsof scratch-off ballots in accordance with the teachings of the inventionare shown. Referring specifically to FIG. 3A, shown is the contestportion of the ballot before being voted by the voter. Each of the twoovals in the example is hidden by a so-called “scratch-off” coating. Tovote for “Fred,” the voter scratches off the corresponding latex orother material and the indicia, “P5” in the example, is revealed asshown in FIG. 3B. Each indicia for each ballot instance was preferablyselected from a range of substantially all possible such two characterindicia preferably by a cryptographic pseudorandom process so that thevoter would substantially be unable to guess the code withhigh-probability. When the ballot is scanned, the absence of the latexis in some examples interpreted as a mark. In other examples the scannerrecords and OCR's the indicia, such as for double check or forseparation of authority or for robustness. Since no special pen isrequired, this example embodiment may be particularly well suited forvote by mail.

Referring now to FIG. 4A-B, plan views of exemplary embodiments ofinvisible ink ballots are shown in accordance with the teachings of theinvention. Referring specifically to FIG. 4A, shown is the ballot beforemarking. Not visible, but printed in the ovals are the indicia ininvisible ink, as will be described further with reference to FIG. 5. Inthe example stage of the ballot shown in FIG. 4B, the voter has appliedthe “developer” agent, such as by a felt-tip marker that has thedeveloper agent as its ink, to develop the mark and make the indiciavisible. The color of the developed indicia, shown black for clarity,can differ and be readily detectable by a scanner or camera or the likeand can similarly be recognized as distinct from the preferablyseparately detectable unmarked positions.

In another aspect, voting by those unable to read the ballot is asignificant consideration for election systems in many settings. Anexample solution in accordance with the teachings of the invention isso-called “template” marking schemes used in some jurisdictions. Votersoptionally are provided with a special digital camera or scanner thatonly images an area as big as a mark position. Ideally it would becombined with a marking device so that a single operation would resultin the marking and recognizing of the code by the device. Such a devicecould then provide a verbalization, or other indication accessible tothe voter, of the code revealed that the voter could then remember orrecord by some means such as an audio or memo recorder.

Voting by those unable to mark the ballot is also a consideration forelection systems in many settings. A special mechanical device thatallows marking of all the positions but does not allow viewing of themarks is anticipated, as can readily be constructed by those of skill inthe mechanical art such as by many pens operated by a common lever or arobot arm and camera that marks all positions. The voter preferablywitnesses such complete marking, is given exclusive private viewing ofthe form, utters the codes they wish recorded per contest (includingoptionally dummies for hidden no votes), and an assistant or automatonrecords these on a special form, a receipt for which is preferablyprovided to the voter.

In another example system for voting by voters unable to read theballot, a pair of recordings is made available to the voter, one ofwhich is chosen by the voter to spoil and to keep for audit. The otheraudio recording is used by the voter to learn the codes associated withthe candidates the voter wishes to voter for. The voter utters the codesand they are marked on a form, a signed receipt for which is preferablyprovided to the voter. The voter optionally keeps an audio recording ofthe exchange. The recorded audio heard by the voter is of course notallowed to be kept by the voter and is preferably destroyed.

Prior art scratch-off and related systems do allow the user to seeindicia otherwise hidden but not without leaving evidence of whichindicia were at least potentially viewed. These systems havedisadvantages, including cost of manufacture, bulkiness of articles,difficulty of making large areas/numbers of indicia available forviewing, and production of scrap. An aspect of the present inventionallows a mechanism that aims to overcome these shortcomings and issuitable for any application, whether or not related to voting or thelike, that realizes the basic functionality: the user can readily seecertain indicia but substantially only after leaving evidence of whichindicia were seen. Furthermore, certain indicia may become hidden whenothers are revealed, as may be related to disclosure by the presentapplicant elsewhere including co-pending applications that are includedhere by reference in their entirety.

In summary, printing on forms is accomplished in a way designed toprotect the codes from being read without leaving marks or at leastwithout leaving forensic evidence. In some examples this includes use of“dummy” inks for regions that are not to develop into parts of indiciaand are substantially difficult to distinguish from the “real” invisibleink that is to develop into parts of the indicia. It will be understoodthat the dummy and real ink in some embodiments are printed innon-overlapping regions but that in other examples they are printed oneoverlapped over the other. For instance, the dummy may be printed overan entire region and the active “real” ink only in selected portions ofthat same region. It will also be understood that various chemicals can“block” or “alter” the color of a region and these can be considered asdummy or real inks as well; for instance, a blocking or altering realink applied to portions of a larger dummy ink region, or as anothernon-limiting example a blocking or altering ink as real or dummy inkapplied to a region with background color. Also various “masking” inkand dye components are aimed at making distinguishing between theinvisible ink and the decoy ink more difficult. Furthermore, obscuringpatterns such as camouflage are optionally applied to make recognizingunmarked indicia still more difficult. Moreover, the form of the indiciais optionally varied substantially unpredictably to further impedeprobing or other covert reading.

Referring now to FIG. 5A-D, plan views of exemplary mark positionprinting in accordance with the teachings of the present invention areshown.

Referring more specifically now to Figure FIG. 5A, the shape of theuser-applied ink shown is intended to at least represent an exampleleft-to-right swipe with a marker pen. Stamps, rollers, crayons orwhatever other type of marker means are believed to be other suitableexamples for depositing chemicals on positions to be marked. Othermarking means are anticipated, including applying energy in such as UVlight or heat. The indicia will be seen to appear dark on light, but isshown dark on white for clarity. It will be appreciated that light ondark (illustrated with reference to FIG. 5B) has the advantage of alarger and more solid mark for compatibility with existing scanningsystems and ease of scanning generally. It will also be appreciated,however, that dark on light without a frame allows indicia to extendcloser to the top and bottom of the mark position, such as may bedesired where vertical space is limited. Nevertheless, in some examplesthe developed mark may be larger than the area oval indicia unmarked.The frame around the code in some or options is present before and aftermarking, in other examples it is at least changed by the marking, suchas to create a more aesthetic and/or readable marked oval.

Referring to FIG. 5B an example background printing that is intended tofurther make recognition of the symbols substantially more difficult isshown in the developed state (for clarity without the marker mark). Forinstance, some invisible ink reagents do not themselves fluoresce,however, they do block fluorescence that would otherwise be visible onthe paper because of such things as so-called whiteners and othercomponents of the paper. Accordingly, the background printing shownpreferably appears substantially similar to the symbol printing undervarious kinds of lighting. Similarly, printing can alter the surface ofthe paper, such as may be visible as differences in the reflectivityrelative to illumination from various oblique angles; however, the tightregistration and of the background printing, which preferablysubstantially similarly alters the surface, is believed to makerecognition of the symbols more difficult without marking. The indiciaappear substantially light on dark in this example, but are shown asdark on white for clarity.

Referring to FIG. 5C, a detailed exemplary embodiment of a pixilateddummy ink and invisible ink position is shown in accordance with theteachings of the invention. The figure shows the position in thedeveloped state (again for clarity without the marker mark); in theundeveloped state the oval is substantially empty with a uniform colorof pixels or covered by a camouflage or other pattern as will bedescribed (with reference to FIG. 5D). The indicia “X3P2” is shown in abitmap type of font with optional thin separation lines between thepixels forming a grid. The indicia are in the real invisible ink and thebackground in the dummy ink, or the other way around. The example showsthe indicia darker (black for clarity) than the dummy when developed,but in some applications for compatibility with existing scanners andfor other reasons the background may be darker than the indicia orwhatever two colors may be used. Whatever masking or camouflage in someembodiments is at the pixel level, so that there may be many different“colors” of pixel in the undeveloped image. So that precise alignment ofthe pixels does not betray their type, slight randomization ofpositioning of pixels is also anticipated as an option. As anotherexample, a two-dimensional barcode as mentioned with reference to FIG. 9may be incorporated pixel by pixel or using four adjacent pixels and soforth.

Referring finally to FIG. 5D, a detailed exemplary embodiment of a superposition camouflage ink pattern is shown in accordance with theteachings of the invention. Various regions are shown in substantiallyirregular shape and each potentially is filled with a different maskingcolor or combination of colors, whether visible and/or fluorescentand/or UV or IR. As mentioned, such camouflage is preferably of thedisappearing or non-visible types of inks and can be printed below,intermingled with, and/or above the dummy and real ink or the realinvisible ink. These techniques can be combined with those alreadydescribed with reference to FIG. 5C for camouflage at the pixel level,as will be understood.

A variety of ways to make, print and develop so-called invisible ink(also variously called for instance latent ink, sympathetic ink, orconcealed image ink) are well known. Such ink systems includingpre-printed ink and a developing marker means have been used inapplications related to education and amusements for children. Someexample prior art includes U.S. Pat. No. 7,111,933, “Ink-jet systems andmethods using visible and invisible ink”; U.S. Pat. No. 6,672,718,“Aqueous latent image printing method and aqueous latent image printingink for use therewith”; U.S. Pat. No. 4,525,214, “Crayon adapted fordevelopment of latent images”; U.S. Pat. No. 5,935,308, “Latent imagejet inks”; and U.S. Pat. No. 5,443,629, “Latent image ink,” allincorporated herein by reference.

In another aspect, it may be feasible to read the indicia withoutleaving a trace. For example, simply printing invisible ink as mentionedwill typically alter the surface of the paper stock, such as due towetting, and this may be detected and read in some cases as simply asusing glancing illumination. Another example mentioned is that aninvisible ink may, even if it does not fluoresce itself, block thetransmission of fluorescence from the paper. The present invention aimsto overcome such deficiencies and is thus applicable to a wide range ofapplications where hidden indicia are used, whether or not they relateto elections or the like. It overcomes such deficiencies in someexamples and at least in part by application of what have here beencalled “dummy” inks. A dummy ink is preferably printed so as to makereading the hidden indicia substantially equivalent to distinguishingdummy ink from “real” invisible ink. For instance, a region is dividedinto sub-regions such as so-called “pixels” and indicia is comprised ofa collection of pixels being printed with real invisible ink and theremaining pixels being printed with dummy ink, as in FIG. 5C. Whendeveloped, the invisible ink turns a color and the dummy ink is adifferent color or no color. Examples of dummy ink include ordinary inknon-changing ink of the desired color and so forth.

Another inventive technique for obscuring symbols printed is by use of“masking” dye as in FIG. 5D. In some examples dye that fluoresces, suchas in the IR, visible, or UV, is added to both the dummy and realinvisible ink to overwhelm any fluorescence difference that they mayhave or any difference that they may cause in the fluorescence of thepaper through the ink. In some examples dye is printed under, with,and/or over both the dummy and the real invisible ink, either uniformlyor in patterns. Patterns are known for obscuring readability of text,and such patterns are examples of patterns in which dye may be printedfor this purpose. More than one set of patterns overlapping each withone or more dye is anticipated. Disappearing dye may also be used toobscure indicia, such that when the area is developed by the special penthe disappearing dye becomes substantially less obscuring and allowsreading of the indicia and/or indicia readable due to the disappearingdye becomes unreadable.

A still further inventive technique for obscuring symbols includesrandomization related to the symbols themselves. The form of the indiciais optionally varied substantially unpredictably to further impedeprobing or other covert reading. For instance, the position of symbolswithin the oval or other region is preferably varied substantially orfully randomly. Another technique is to change the “font” or way thesymbol is rendered, such as including distortion or the like. Furtherexamples include so-called CAPTCHA techniques and puzzles and the likethat encode a symbol in a way that requires some intelligence or thoughtto decode.

One issue with paper ballot voting systems where serial numbers onballots are desirable, such as where required by law or for voters touse in online checking of coded-vote receipts, is that poll workersmight be able to readily learn which voters are issued which numbers. Asecond issue is present in some settings, however, where the paperrecord should not include linking information and it is desirable toremove the identifying information from ballots after they are capturedelectronically. A third issue, which occurs for instance in so-called“scantegrity” style voting systems, whether invisible ink is used ornot, is that ballots may be identified by the particular codes voted andthis is undesirable in certain settings. All three issues mightfacilitate certain so-called “improper influence” schemes, particularlyin case the ballots are to be hand-counted at a local level.

The second issue, where it is an issue, can be dealt with at least insome settings by modifying the ballots after they have been cast, aswill be described with reference to FIG. 6. The first and third issueswill be addressed later by use of special ink systems, to be describedwith reference to FIGS. 10 through 13.

The term “identifying” as used here in some examples relates to theidentity of a document or record or other non-human entity. The term“de-indentify” will be used here for any method or means that removesidentifying information and/or makes such identifying informationinaccessible or hidden or unlinked. An object will be said to be“disassociated” with an informational or physical entity if the two arenot readily linked.

Turning now to FIG. 6A-D, plan views of de-identifying and de-identifiedballots and delayed counterfoils in accordance with the teachings of thepresent invention are shown. Four views are provided illustrating stagesof the ballot: FIG. 6A, unvoted; FIG. 6B, partly marked by voter; FIG.6C, marked by voter and counterfoil separated and marked by poll-worker;and FIG. 6D, ballot de-identified and counterfoil developed. The inksystem used by voters to mark the ballot and reveal the codescorresponding to the positions marked eventually changes to hide thecodes, as seen in FIG. 6D. Also, the codes on the counterfoil are markedin FIG. 6C, but only develop later as shown in FIG. 6D. Part of the formis removed to de-identify it in FIG. 6D.

More specifically, referring now to FIG. 6A, the unvoted ballot form isshown. Included, as will be seen, are two plurality contests asexamples, each with jelly-bean-shaped areas to fill. Any pre-fill, to bedescribed with reference to FIGS. 7 through 10, is not shown forclarity. An optional perforation line or the like shown across thebottom allows for the convenient separation of the counterfoil chit thatwill be provided to the voter after the voter has cast the ballot and tobe described in more detail with reference to FIGS. 6C and 6D. The upperleft corner of the form contains a 2-d barcode, as an example of dataidentifying the ballot serial number that is preferably not readilyrecognizable and read by a poll-worker. The upper right corner has ahole drilled in it, to allow locking to a clipboard for prevention ofso-called “chain voting” and the like. Two solid black circles areprinted on the lower corners of the form (above the perforation) thatare intended to serve as examples of alignment marks, if used.

Referring to FIG. 6B, the state of the form is substantially the same asalready described with reference to FIG. 6A, except that the voter hasmarked one position in the first contest. This marking preferably takesplace in a booth.

Referring now to FIG. 6C, the voter has completed marking the form andthe counterfoil has been detached and activated by the application ofdeveloper. This is the state of the ballot after the voter has finishedmarking in the booth and provided the ballot for scanning or inclusionin the ballot box and the ballot has been successfully scanned or castand the counterfoil removed and the developer applied to it. The votertakes the counterfoil home and the ballot is in the ballot box.

In other example embodiments, not shown for clarity, the counterfoil isprinted on by a printer at the time of ballot casting. In one suchexample a so-called “public key digital signature” or other suitableauthenticator is included on the counterfoil at that time. The values soauthenticated include, but are not limited to, the so-called “serialnumber” of the ballot that the voter can use to check on the recordingof the codes or that is printed on the forms so that the voter can learnit; the codes voted by the voter; and/or a timestamp. Such printing canbe in human readable form and/or machine readable form such as barcodes.In some examples the printed receipt is provided on a separate piece ofpaper. It is believed that a such a printed receipt can obviate the needfor a counterfoil in some settings and threat models. In some examplesthe receipt is shown to the voter all or partly “under glass” before theballot is cast.

Referring finally to FIG. 6D, physical de-identifying as well as twoaspects of the time delay in the ink system are shown. The upper leftcorner of the ballot form, which had the barcode identifier printed onit as earlier described with reference to FIG. 6A, is now shown astrimmed off. In some examples, not shown for clarity, a paper drill maybe used instead of a paper cutter and in some examples all four cornersor a center portion are removed to avoid the need to orient all theforms the same way. The codes revealed to the voter during marking, asshown in. FIGS. 6B and 6C, have become hidden due to slow-acting ink.The codes on the counterfoil, however, to which developer was applied asdescribed in FIG. 6C, are now revealed to the voter.

In some examples the codes revealed to the voter on the counterfoil,whether or not by delayed ink, and whether or not on a detachablemember, optionally server at least a number functions: provide a handy“ballot serial number” identifier for the voter to use in looking therecorded codes up online (particularly in the case the case that thecodes are not unique, as mentioned); protection against multiple votersbeing issued the same ballot number, provided that there is substantialprobably that the they vote differently; providing authenticators thatprovide at least probabilistic evidence that the ballot was in fact castand not spoilt for whatever reason; provide a means for poll-workers toremove, such as physically, such probabilistic evidence in the case theballot is spoilt. In the case that the poll-workers remove anauthenticator for a ballot that is to be audited, such as what has beencalled a print-audit ballot, it is preferable that only part of theauthenticator is removed and even that which part is random or otherwisenot under the control of the poll-worker, so as to allow the at leastprobabilistic audit of the full printing on the ballot forms.

Traditional “document scanning” systems (here understood to include byscanning or photographing or whatever sensing means), the scanning meansand associated hardware and/or software systems generally referred tohere as “image processing,” look for marks and are known to make errors.For example, errors include cases where parts of a form do not scan,such as because of wrinkles, folds, torn parts, smudges, spills,misfeeds, alignment error or other reasons. Also, alignment accuracy canbe an issue, such as when forms slip against rollers in scanning or moveon a platen. Also, changes in paper size due to manufacturing tolerancesand changes in humidity reduce the efficacy of alignment-based positionrecognition. Furthermore, deliberate redactions of parts of a form arealso unnoticed.

The inventive system disclosed here preferably finds all what will becalled “position indicators,” whether marked or unmarked, beforeaccepting the scan. This approach is believed to address the abovementioned problems. In some examples the pattern of position indicatorsalso optionally serves as an identifier of the form type or so-called“ballot style” and/or as a registration or alignment pattern. In orderto enhance protection against errors and even attempts to reportincorrect scans by scanners, in some exemplary embodiments, codedpatterns are printed. In those embodiments where marks hide the codedpatterns, their absence provides security or at least resilience againsta scanner incorrectly reporting the absence of a mark; where marks causeother codes to develop, a positive interlock between the form and thescanner is provided that can prevent the scanner from incorrectlyreporting the absence or even presence of marks.

In some examples marks are not readily human-readable, such as twodimensional barcodes formed from dots and the like. If pens suppliedcreate a substantially transparent “highlighter” type of mark, then thebarcode dots are optionally in a similar color so that they would becomesubstantially less noticeable after marking or, as another example, thecolor former of the marks can in effect be erased or what is referred tohere as “disappear” by components in the pen ink.

Turning now to FIG. 7A-C, detailed exemplary embodiments of pre-filledpositions are shown in accordance with the teachings of the invention.Shown are pre-filled ovals, as an example of a position indicator for amark position without limitation. The “pre-fill” is pre-printed indicia,preferably unique on the form and that is accordingly recognized byscanners, such as a uniform light color that is readily recognized by acolor scanner. The ovals are shown unmarked in FIG. 7A and marked inFIGS. 7B and 7C, the marking in 7B and 7C illustrating differentexamples. FIG. 7B shows a mark for the second position as a solidobscuring blob, such as formed by a pen, pencil or marker. FIG. 7C showsa mark that interacts with the pre-fill to create a third color or otherrecognizable indicia, allowing the scanning system a more positiverecognition that the position had been marked. One example of suchinteraction is a transparent color of a marker pen that interacts withthe color below, as is known; another example are chemically interactingpens, such as are known as children's toys sometimes part of a “magicpen collection” made by Crayola, of Easton Pa., where one pen ink wouldbe pre-printed and the other applied.

Referring now to FIG. 8, plan views of exemplary embodiment ofpre-filled position patterns are shown in accordance with the teachingsof the invention. FIG. 8 illustrates two large ovals with complexpatterns that could be printed in black and white or in one or morecolors.

Referring now to FIG. 9A-C, plan views of detailed exemplary embodimentsof pre-filled coded position forms are shown in accordance with theteachings of the invention. The scanner preferably OCR's such marks orreads the barcodes and thus has a positive check that it has seen anunmarked position correctly. The barcode can be, for instance be: asimple fixed pattern, preferably per position; a random or pseudorandomvalue with or without redundancy; and/or a cryptographic authenticator.In some examples the values are even such that they can be combined inan error correcting code to reveal a public key digital signature. Forinstance, each mark constitutes a signature on its own in some examplesand in other examples a linear combination of marks per contestdetermines a signature.

In FIG. 9A the coded pre-fills, barcodes (in the example of the symbols“dfsh” and “3oidr”), are preferably printed in a color substantially thesame as the marker color or that will develop to be substantially thesame as the marker color, that will be well hidden by the marker color,or that will develop to be invisible. With a so-called “2-dimensionalbarcode,” even marks that only cover a horizontal part of the area bythe voter are positively detected since the code is obscured and cannotbe read.

In FIG. 9B the second position is shown marked with a substantiallyobscuring blob, such as might be made for example by a pen or pencil.The coded information is thus obscured from being recognized by thescanner means.

In FIG. 9C, the marking pen means includes a developer for the invisibleink that reveals a separate code, in the example a human-readable code.The barcode for “3oidr” is shown as hidden and the code “6J2” revealed.It will be understood that such a desirable result, as will be describedfurther with reference to FIG. 10C, is readily achieved with knowntechnology such as a combination of invisible and disappearing inks,whether for instance applied in the same locations or in alternatepixels.

Turning now to FIG. 10A-C, combination flowchart and block diagrams ofexemplary embodiments of pre-filled positions and related systems areshown in accordance with the teachings of the invention. Each of thethree FIGS. 10A-C illustrates an example system for a case alreadydescribed with reference to FIG. 8, 9A-B, and 9C, respectively.

Referring now to FIG. 10A, the positions on the optical scan form areprinted 1001 in a way that is readily recognizable by the system asdistinct from other areas on the form. The form is marked 1003 and theunmarked position are recognized 1005. The marked positions are sensed1007 such as in the known art. Finally, the system preferably ensuresthat all positions on the form are accounted for 1009, either as marked1005 or unmarked 1007.

Referring now to FIG. 10B, the positions on the optical scan form areeach printed 1020 with a code that is preferably at least unpredictableto certain parts of the system. The form is marked 1022 in a way thathides the codes in those positions marked. The codes from the unmarkedpositions are sensed 1024 and these codes are reported 1026. Finally,the system preferably ensures that the codes reported by a part of thesystem in box 1026 are consistent with those know to have been printedin box 1020. Additionally, but not shown for clarity, the markedpositions are optionally sensed and all positions are accounted for.

Referring now to FIG. 10C, the positions on the optical scan form areeach printed 1041 with two codes preferably at least unpredictable to atleast some parts of the system. A first code remains visible until theposition is marked, but then becomes substantially unreadable when theposition is marked; a second code is substantially unreadable until theposition is marked, but then becomes substantially readable after theposition is marked. When positions are marked 1043, the correspondingfirst code becomes unreadable and the second readable. When the form isscanned or otherwise sensed, the codes readable in each position arepreferably obtained 1045 by at least a part of the system. The codesobtained in 1045 are then reported in 1047. Finally, the reported codesare preferably checked 1049 as consistent with the codes printed and thepositions marked.

More generally, slow-acting ink optionally in combination with theinventive “dummy” and “real” invisible ink systems previously disclosed,provides advantages for applications beyond voting systems.

One inventive aspect uses the standard invisible ink but a slow-actingink as the dummy ink. This allows reading of the symbols initially oncethe form is marked with the developer pen, as the invisible ink turnscolor substantially immediately; but it prevents reading later, once thedummy ink eventually turns substantially the same color or darkness asthe developed invisible ink. A second inventive aspect is that theinvisible ink is slow-acting and the dummy ink remains a dummy. Thislatter approach allows symbols to be activated by someone, such as apoll worker in the example application of elections, and yet that personor an onlooker is prevented from reading the symbols, even thoughanother person, such as the voter, who later obtains custody of the formis able to read the symbols after a delay.

In order to keep slight development of the inks from allowing thesymbols to be read too early, various masking symbols can be printed,whether static or with stunted development. As an example, the dummy inkis also a slow-acting ink preferably matched to the invisible ink duringan initial time segment but the extent to which it can develop islimited; both inks start changing in a substantially indistinguishablemanner for some time period and then they change in a different mannerto allow later reading of the symbols. As another example, a“camouflage” or other obscuring pattern printed in muted colors ordarkness makes it difficult to read the symbols when they are onlypartly developed but does not substantially interfere once they aresubstantially developed. As a further example, some printing may fadeout to reveal or make the hidden symbols more readily readable. Maskingpatterns can be printed in conventional ink and/or using inks thatchange as they develop.

The speed of development of invisible inks is well known in the art. Inmany traditional settings, ink formulators struggle to make the speed ofdevelopment high and ways that do not provide adequate speed areconsidered undesirable but well known. For instance, generally it occursthat dilute or otherwise weakened forms of inks develop more slowly.Also, of course, physical impediments to the mixing of the chemicalagents, such as wetting time, are known to delay formation of color.

In a first embodiment, a combination of pre-applied materials, such asprinted inks, in combination with post-applied materials, such aspen-based developer, results in an area that is not substantiallyhumanly readable after the pre-applied materials are applied but thatbecomes humanly readable a substantially pre-determined time after thepost-applied materials are applied. In one example, the first embodimentis used to pre-print form identifying information on forms supplied topersons, where the person supplying the form applies the post-appliedmaterials but is not substantially able to read the form identifyinginformation although the person who receives the form is later able toread it.

In a second embodiment, a combination of pre-applied materials, such asprinted inks, in combination with post-applied materials, such aspen-based developer, results in an area that is not substantiallyhumanly as readable after the pre-applied materials are applied and thatbecomes humanly readable substantially immediately after thepost-applied materials are applied but that become substantiallyunreadable some substantially pre-determined time after the post-appliedmaterials are applied. In a second example for elections, the positionsmarked by voters are printed with the pre-applied materials and thepost-applied materials are applied by voters making symbols visible tovoters but where the slow-acting process later hides those symbols, suchas during archiving or hand-counting.

Turning now to FIG. 11A-D, combination plan and schematic views of anexemplary fade-out invisible ink system in accordance with the teachingsof the present invention are shown. FIG. 1A is an example of a singlesymbol when the real ink and dummy ink are applied and is substantiallyblank or a substantially uniform masking color to enhance theindistinguishability of the symbol foreground and background regions.

Referring to FIG. 11B, the same region of FIG. 11A is shown having beenexposed to post-applied materials such as a marking pen or dauber. Theletter “E” is readily visible, as the background has substantiallyturned black and the foreground has only turned slightly darker, stillshown as white for clarity. Then in FIG. 11C, preferably a few minuteslater according to the concentrations of the materials, the foregroundcan be seen to be well on the way to turning black. In FIG. 11D, afterthe pre-determined time interval, such as ten or fifteen minutes in someexamples, the foreground and background have become substantiallyvisually indistinguishable black.

In some examples, as described already, this effect is achieved forinstance by a slow-acting ink being used for the foreground and a fastacting ink for the background. In other examples, more generally, thebackground moves towards the foreground as an aspect of ultimatelyhiding the symbols. As will be appreciated, the notion of foreground andbackground of a symbol and darkening images are only examples and aresimplifications for clarity.

Turning now to FIG. 12A-D, an exemplary fade-in invisible ink system isshown in a combination plan and schematic view in accordance with theteachings of the invention. Again the first pane, FIG. 12A, contains thepre-applied materials but with the regions substantiallyindistinguishable. Then in the second frame, FIG. 12B, the two regionsare each starting to develop, but remain substantially indistinguishablein this initial stage (although a slight difference is shown for clarityin the diagram). This hiding effect can, not shown for clarity, beenhanced by a seemingly random pattern of low intensity that obscuressubtle differences at this level of darkness but that is overwhelmed bysubsequent levels of darkness. Later, in FIG. 12C, the background regionhas begun changing color more slowly if at all, while the foreground iswell on the way to black, allowing reading. Finally, FIG. 2D shows theforeground fully developed to black for high-readability and evenarchival retention in some examples. In other examples, more generally,the two regions go off in different color and/or darkness directions toultimately reveal the symbols in visual contrast sufficient forreadability.

Turning to FIG. 13A-C, combination block and flowcharts of exemplaryfading invisible ink systems are shown in accordance with the teachingsof the invention.

Referring specifically now to FIG. 13A, an exemplary fade-out invisibleink system application is shown. In a first step 1301, the materials areformulated, with the two inks referred to as “real” and “dummy” forconvenience. In a second step 1303, the inks are applied to the paper orother substrate to unreadably record certain symbols by an exampleforeground and background method. (Other methods of recording andrendering symbols, such with more types of regions, are anticipatedfully but not described for clarity.) Then, for each use of the forms1305, they are provided the user in a first iterated step 1307 alongwith means for activating the materials, such as suitable pens or thelike. This allows the users to learn the symbols, at least those thatare physically exposed to view in a developed state. Then in a seconditerated step 1309 the symbols on the forms become unreadable and theforms are processed further without those seeing them being able toreadily determine the symbols.

Referring specifically to FIG. 13B, an exemplary fade-in invisible inksystem application is shown. In a first step 1320, again the materialsare formulated and in a second step 1322 they are applied to unreadablyrecord certain symbols by an example foreground and background method.(Again, other methods of recording and rendering symbols, such with moretypes of regions, are anticipated fully but not described for clarity.)For each use of the forms 1324, they are provided to the user in a firstiterated step 1326, but with the original materials activated by thepost-applied materials, such as by a suitable pen stroke or the like.This keeps the symbols from those activating them and those observingthe activation. However, in a second and subsequent iterated step 1328,the symbols on the forms become readily readable allowing the user whoobtains the form substantially quickly thereafter to learn the symbols,at least those that are physically exposed to view in a developed state,once the materials develop sufficiently.

Some paper-based election systems are subject to potential manipulationbecause marks that could have been made by voters but were not made bythem are later added to ballot forms after voters have cast them. Theseillicit marks can add votes or “overvote” and thereby spoil votes.Several exemplary aspectes to addressing these problems are disclosedhere. They can be applied separately and/or in combination. One suchaspect changes how voters vote and will be described first, withreference to FIGS. 14 and 15. Another example aspect diversifies thepens to make undetected addition of marks difficult, as will bedescribed with reference to FIGS. 16 and 17. A still further typefreezes ballots after marking, as will be described with reference toFIGS. 18 and 19.

Turning now to FIG. 14A-D, plan views of exemplary embodiments of ballotforms providing mark count contests in keeping with the spirit of theinvention will be described. Four examples are shown as FIGS. 14A-14D,with the second and third being unmarked and marked variants of the samefaun, as will be described. As will readily be appreciated, FIG. 14Ashows a typical optical scan ballot form, except that the last contest,contest number three, has two options, one corresponding to the numberone and the other to the number two. The voter would be instructed, notshown for clarity, to mark the number corresponding to the number ofmarks made on the rest of the form. That is, if the voter voted for onlyone of the two plurality contests, then the voter should mark the firstposition corresponding to a single mark; but, if the voter voted in bothplurality contests, the voter should mark the second position,corresponding to two marks. Of course it will be understood that otherpossibilities not shown for clarity may also be included, such as thatthe voter “overvoted” by marking both candidates for both contests.

Referring now to FIGS. 14B and 14C, ovals suitable for scratch-off orinvisible ink marking are shown, as described elsewhere here. The ovalcontent is thus obscured in FIG. 14B and revealed in FIG. 14C for anexample vote for a single candidate in the example and the correspondingthird contest is voted with the correct mark count of one. Each oval hasa code, preferably unique at least per contest. If the voter marks themark count, a code is revealed. The voter can do this before scanning orafter scanning. If the voter does not mark and the scanner reveals thecode, the voter can check it by marking before casting or by spoilingthe ballot, as will be described with reference to FIG. 15.

Referring now to FIG. 14D, a ballot that can be regarded as of theoriginal Scantegrity type is shown. If the scanner were to display thecode next to a mark count and a poll-worker or printer were to write iton a receipt, then the voter would have a record and could also complainif the wrong code were written. The code would, of course, not revealhow many marks the voter made.

Turning now to FIG. 15, a flowchart of an exemplary embodiment of a markcount code receipting scanner in keeping with the teachings of theinvention will be described. The first step 1501 is the allowing of thevoter to mark the ballot, including allowing the voter to mark the markcount contest, as has already been described with reference to FIG. 14.

When the ballot casting begins 1503, the scanning device counts thenumber of marks on the ballot 1505. The device also reads 1507 any markfor the mark count contest. The device then checks 1509 whether there isa discrepancy between the two values, if both are present, in which casean error condition 1511 is raised, as will be understood. If no errorcondition is raised, the mark code is preferably made known 1513 to thevoter, for example by being displayed and/or printed. In some examplesthe printing is over the ballot form itself and optionally butpreferably includes highlighting of the marks made by voters in a waythat indicates how they are interpreted.

The voter is preferably allowed to check the ballot 1517, so that thecount code can be checked if it were not marked or the code was notknown to the voter. The voter may also choose 1515 to cast the ballot1519 either without checking or in some examples, not shown for clarity,even after checking.

In paper ballot systems voters generally do not make enough marks toprevent someone from adding additional marks to the ballots, as has beenmentioned. Some such what will be here called “added” marks canintroduce votes for candidates or questions that the voter did not voteon, while others can cancel the validity of a vote through introducingso-called “overvotes.” Related is what will be called “injection” offraudulent ballots into a voting system, typically accompanied by whatwill be called “removal” of ballots to compensate for some or all ofthose injected.

An aspect of the present invention is directed at preventing theundetectable addition of marks or injection of ballots through what willbe called “diversification” of marking devices. Generally, in someexample aspects and by way of summary, pens provided for marking ballotshave different components and preferably components that vary as the penis used so as to make it difficult to add marks later without leaving atleast forensic evidence. In some exemplary embodiments, “static”differences between pens preferably also make it difficult to recognizewithout special knowledge and/or equipment. In addition to such staticdiversification, markers may what will be called “dynamically” makedifferent marks, the marks differing over time that the marker is used.Static and dynamic diversification can be combined in the same markers:marks can reveal, at least forensically, which marker was used and ifthe marks were made a substantially during what will be called the samemarking “session.”

As just one illustrative example of static diversification, pens eachcontain a different combination or distribution of forensic taggants.Further, voters preferably mix the pens in a container after using themso that which pen is used by which voter or ballot is not readily known.

As just one illustrative example of dynamic diversification, the inkwick reservoir of a marker pen is filled with different solutions duringits filling such that as it is used the composition of the ink varies asthe solutions are wicked and even potentially mix. This then results ina substantially unique combination, such as of dye and/or taggants inthe ink that changes as the pen is used and becomes substantiallydifficult to replicate for the purpose of adding marks that areresistant to visible, automated, and/or forensic discovery. Suchreservoir systems will be referred to generally here as “gradedreservoir” inking systems.

When markers are even statically unique, modification of ballots withoutthe corresponding marker becomes difficult. When there are a largenumber of potential taggants per marker, for instance, then even knowingthe combination for a particular marker may still leave it difficult toreproduce. Moreover, not all taggants used need be revealed or known toall entities. In some examples, taggants are sparsely distributed inmarkers, so that the full set in a marker may not readily be determinedfrom the marks on a ballot.

Destruction of markers can improve resistance to injection of ballots.For instance, if the collection of unique markers used in voting becomesknow, such as based on serial number of markers remaining in a batch,but the markers are themselves destroyed, it may be difficult for thosewishing to inject ballots to learn what the characteristics of thedestroyed markers were and/or to duplicate them sufficiently well. Inother examples, the set of markers used is hidden by being mixed in witha larger batch of markers.

A particularly practical example is where markers are unique and eachpolling place is randomly assigned a small number of markers, such as asmall multiple of the number of voting booths at that polling place. Theassignment to polling places is, for instance, simply by selecting ahandful of markers for that polling place from a bin. Voters are to takea marker at random from a container at the polling place, vote with it,and return it to the container. The container preferably provides formixing of pens, such as with a hopper. In one example, the last votersat the polling place each destroy or witness the destruction of theirmarker; alternatively, markers can be returned with ballots andaccounted for but preferably mixed in a large batch to make findingparticular markers more difficult. In an example variant, oneorganization supplies the ballots and another, the markers.

Turning now to FIG. 16, a section of a diversified marking device inaccordance with the teachings of the present invention is shown. Thebody 1610 holds a writing tip 1630, such as a so-called “felt tip” orother porous and/or rotating ink dispensing means. Also contained in thebody is the “ink” 1620, such as a liquid or a gel. Ink 1620 may behomogenous or deliberately not. In the former case, diversification isachieved by including various markers, taggants, additives, colorants,tell-tales or the like so that the marks of pens are substantiallystatically diversified. This is preferably accomplished in a way thatleverages secrecy of the inclusions and difficulty of detection and alsopossible interaction of the inclusions.

The non-homogenous dispersion of ink 1620 separately or additionallyprovides dynamic diversification. Pens with marbled gel are known andeach color of such a gel in one embodiment is instead be replaced by acovert taggant or taggant mixture. In other examples ink 1620 isdelivered by capillary action through a medium and the capillary isloaded with two or more different inks, for instance one from one endand the other from the other end, so that the combination of them variesgradually as the pen is used.

Turning now to FIG. 17A-B, combination flowcharts and block diagrams ofpen diversification systems are shown in accordance with the teachingsof the invention. FIG. 17A is directed at a static diversificationsystem and those of FIG. 17B include dynamic diversification, butcombinations of the two are anticipated.

Referring to FIG. 17A, Box 1701 shows the provision of pens to thevoters in a way that preferably allows the voters to introducerandomness by their selection of pens and in which the pens arestatically diversified, which is referred to as “making subtly differentmarks” in the drawing for clarity. The next two boxes, 1703 and 1705,indicate instruction to voters to take actions, for completeness, butthe actions by voters are not intended to be essential steps in theprocess. Box 1703 indicates that the voters are instructed to take thepens provided in step 1701 and use them to make marks. Box 1705indicates that voters are to return the pens. Finally, box 1707 providesthe property obtained, which is that the static diversification of thepens leads to marks that are different per pen.

Box 1720, now referring to FIG. 17B, shows the provision of pens thatare at least dynamically diversified to voters. Again, box 1722indicates instructions to voter and voter action is not itself anecessary step. The instructions are to use the pens to mark theballots. Finally box 1724 indicates the property of dynamicdiversification, which is that marks made later would show a lack ofcontinuity and be substantially recognizable as such.

Paper ballots can be what will here be called “processed,” or also here“frozen,” after marking by voters so as to substantially make subsequentmarks recognizable as such. Such processing or freezing will also becalled “protection.” One example way to freeze a marked ballot would beplastic laminating. While full front-back laminating may be undesirablein practice for various reasons, coating in limited areas with thinplastic layers may be quite practical as will be described. Anotherexample way to freeze a ballot will be called “passivating” theunderlying reactive agents in the ballot so that they will notsubsequently react with marking ink at least in the usual manner. In yetanother approach, a developing process alters the unmarked regions ofthe ballot that have not been marked already by an ink containing afixative.

Turning now to FIG. 18, a plan view of an exemplary embodiment of afrozen ballot in accordance with the teachings of the invention isshown. A ballot 1810 is depicted with various regions, shown as stripes1820, of a preferably transparent plastic material fused on. Forexample, incorporated into the scanner or as a separate device is amechanism like a laser printer that uses a preferably clear ortranslucent toner to preferably print stripes on the ballot form. It hasbeen verified that such stripes are difficult to remove and are not veryreceptive to inks or invisible ink developer. Thus, marks made beforecoating will be protected under the coating and those made after will beprotected from the paper by the coating. Moreover, the active areas arebelieved passivated to prevent later marking. When an audit step isconducted, ballot marks are preferably selectively inspected and marksmade after coating are revealed as improper. In other examples theregions 1820 may be aimed primarily at passivating underlying reactiveareas.

Turning now to FIG. 19A-B, combination flowcharts and block diagrams ofexemplary embodiments of freezing against undetectable post castingmarking in keeping with the teachings of the invention will bedescribed. Two examples, FIGS. 19A and 19B, are included: the formerwith a coating over the marked ballot and the latter passivating activeregions, as will be described.

Referring now to FIG. 19A, box 1901 shows the opening of the polls, box1903 the voter being allowed to mark the ballot, and 1905 the voterbeing allowed to cast the ballot. Preferably directly after casting theballot receives at least a partial coating 1907, such as has beenillustrated with reference to FIG. 18, as already described. Whenauditing 1909 is optionally initiated, ballots are inspected 1911 todetect marks that were made after coating, such as marks where thecoating was tampered with in order to insert marks below it.

Referring now to FIG. 19B, box 1920 shows the opening of the polls, box1922 the voter being allowed to mark the ballot with ink containing afixative, and 1924 the voter being allowed to cast the ballot.Preferably directly after casting, the ballot receives development 1926,such as by the heat of a thermal printer (or by UV light as is known).Incorporated into the pen ink are chemicals or other means that act as afixative to prevent the marked regions from developing. Thus, marks madebefore coating will be protected from developing and so will beapparently undeveloped, while those made after will be on areas of thepaper that have developed. Another approach, different from thatdepicted but as will readily be understood from the depicted version iswhere the active color-changing elements in the ink are passivated bythe “development” 1926 and then are not readily activated by subsequentapplication of a marker. When an audit step 1928 is conducted, ballotmarks are preferably selectively inspected 1930 and marks made afterdevelopment are revealed as improper.

Turning now to FIG. 20, a combination block diagram and flowchart of anexemplary embodiment of an audit choice commit system in keeping withthe spirit of the invention will be described. When voters are able torequest the full “opening” a commit that would reveal how they voted,there is a danger that they would be caused to do this under a signalfrom someone who is attempting to influence their vote improperly andwould obtain access in to what is in effect a spot check on the vote.For example, the voter might receive a pager alert, phone call, textmessage or might hear a certain sound or word uttered in the pollingplace and would then the request to leave the booth and scan the ballotthey have been marking while requesting it to be audited. The resultingreceipt or process would then allow others to verify how they had voted.

One exemplary inventive approach to preventing such a threat includes,in the first step after the voting session begins, such as when theballot is issued to the voter, the voter making a commitment as towhether they will cast or audit. This commitment should not be readilyknown to other than the voter (as it could be used to moot efficacy ofthe audit) yet it is preferable that the time that the commit is made,and that it is not modified until it is supposed to be opened, isreadily verifiable by those in the polling place. In one example, thecommit is made when the voter enters the booth and placed outside orabove the booth so that it is readily visible; the choice committed tois preferably hidden, such as in a box or envelope or otherwise. This isindicated in the manual operation box 2003, shown after the beginning ofvoting 2001.

Once the commit is made, the voter is able to mark the ballot in thebooth 2005 and then the ballot is read or scanned 2007. (In the case ofa so-called DRE these two steps, 2005 and 2007, are combined into thevoter entering the vote selections into the DRE machine.) In someembodiments, the voting system commits 2009 to the receipt, such as byprinting under glass, that may later be revealed to the voter in step2017. At this point the voter commit is opened 2011. One of thealternative paths shown as choice 2013 is that the value committed to is“audit” and then the details are opened to the voter 2015 includingrevealing the vote; if the choices is “vote,” then the ballot is cast2017. The voting session then ends 2019.

Turning now to FIG. 21A-B, combination section and schematic views ofexemplary embodiments of indelible marking buttons in keeping with theteachings of the invention will be described. Each of the two buttons2110 a and 2110 b is shown in a different configuration: the one on theleft 2110 a in the un-pressed state and that on the right 2110 b in thepressed state. The urging means, shown for clarity as helical springs2120, urge the buttons 2110 a-b into the un-pressed state, as will beunderstood. The buttons 2110 a-b move axially through guide means 2130a-b. The punch end 2150 of the mechanical linkage 2140 a-b marks thepaper 2160 by penetrating through it. Also, the switches 2170 a-b areshown as activated when the punch 2150 marks the paper 2160.

Anticipated is whatever substantially transparent means for marking thepaper substantially permanently here “indelibly” as selected by thevoter and for providing indication to the equipment of the voter choice.

Referring now specifically to FIG. 21B, a printer 2180 is shown withportions of the paper receipt 2160 that has been printed protected by asubstantially transparent cover means 2190. Two buttons 2110 of the typealready described with reference to FIG. 21A are shown configured topunch into different positions across the printed web. In one example,the buttons indicate whether the voter wishes a random input of “L” or“R,” as will be described. In another example, the buttons 2110 indicatewhether the voter wishes to cast or to audit a ballot. Other exampleswill be understood, such as three buttons, one for each of cast, audit,and return the ballot.

Turning now to FIG. 22, a flowchart of an exemplary embodiment ofunpredictable ballot differentiation in keeping with the teachings ofthe invention will be described. The voter choice segment shown ispreferably inserted in the overall flow during scanning and beforecasting. In other examples that include audit, it preferably precedesaudit. The beginning and end of the segment are shown as entry points2201 and 2275, respectively. The voter makes a choice 2203 between twobuttons, for example, one called “L” (for instance on the left) and theother “R” (on the right). The buttons, as already described withreference to FIG. 21, mark the form in a corresponding distinguishableway. Button “L” for instance marks one way 2205 and button R 2251 marksthe other. Also, the sensor means 2170 communicate the choice made tothe mechanism, where it is obtained, as indicated by boxes 2207 and2253. If an encrypted receipt is printed, as is preferred, as shown inboxes 2209 and 2255, then it preferably includes the respective choice.As will be understood, if the printing is inconsistent with theindelible mark made by the buttons, the receipt is a kind of evidence ofimproper behavior of the mechanism.

One example use of such a mechanism is for making identically printedballots that are voted the same way have a substantial chance of havinga different “L” or “R” choice, which is interpreted as an extra contestwithout consequence that is adequate to distinguish instances ofidentically-printed ballots. Another example use of such a mechanism isto input a choice of whether the ballot is to be cast or audited, asalready mentioned. Without such indelible marking of the choice, themechanism might get away with cheating by ignoring the voter choice andtaking another choice that allows it to avoid detection as havingprinted an improper receipt. More than two-way choices and more than onechoice instance allow more than two alternatives, as will be understood.

End to end voting systems, such as Punchscan and Scantegrity disclosedby the present applicant, are substantially aimed at allowing legitimatevoters to ensure that their votes are in fact counted. Addressing thethreat sometimes referred to as “ballot box stuffing” is aimed atpreventing counting of votes not from legitimate voters, which is alsobelieved substantially important in ensuring election integrity.

Known techniques for preventing stuffing include the use of so-called“poll books” in which voters sign for their ballots next to apre-printed copy of their name and address. In other examples, a sign-insheet is used on which voters each fill the next blank line with theirsignature and other information. So-called “automated poll-books” aretypically computers that election workers use to look up voters andensure that they have not yet voted at the present or in some casesother polling places. Some of these include printing a slip for votersto sign. Also, some voting machines have contained a so-called “publiccounter,” which mechanically counts in public view each ballot cast.

Shortcomings of such systems include the reliance on those at thepolling place to ensure that votes are not cast for voters who are notpresent. For instance, stuffing can occur around the close of polls,once it is known that certain voters did not appear and poll-bookentries can then safely be made on their behalf. In other examples,ballots are cast before the opening of polls for voters known not ableto attend. The first voters to arrive or the last to leave may raise analarm about such stuffing by those in control of the polling as place,although such early or late voters are typically not trained andgenerally unable to obtain compelling evidence. Without compellingevidence, ambiguity and corresponding lack of accountability isintroduced as to whether stuffing has been conducted at the pollingplace, during transport, or centrally. It would be desirable to ensurethat a “public counter” like function of the polling place moregenerally is in fact viewable by the general public and not just thosein attendance at particular times.

The present invention includes among its objects addressing the aboveshortcomings and providing practical, efficient, secure, and economicalarticles and systems to do so.

In brief summary, in a simplified example without limitation, theinvention includes a form that contains pairs of codes associated witheach of a series of positions. The codes are preferably printed inso-called “scratch off” and/or the ink systems described earlier withreference to FIGS. 5 and 12. A pair is assigned to a voter preferablysubstantially at the time the ballot is issued to the voter, such as bythe voter or a poll worker choosing the next position on a list of suchpositions. The voter is preferably able to at least influence theselection of which code is to be revealed, preferably by a randomselection, or by voter choice. The code is revealed by the developmentof the invisible ink, such as by swiping a suitable pen or dauber overit, as has been described, or by scratching off or otherwise removing aprotective coating or covering. The voter is preferably able to recordthe code so revealed, such as by writing it down, dictating it, orremembering it. In one example system, the poll workers are to upload inreal time to an automated system an indication of the code released.Voters are preferably able to check online to see whether the code theyhave recorded has been posted and/or to provide it for posting. Thetiming of the posting of the codes, if in real time, is believed tosubstantially provide in effect a real-time public counter online.

As will be appreciated, it is believed that an attack that attempts topublish codes in advance of the choice by voters runs the risk ofincriminating itself by posting the member of the pair that ultimatelyis not selected by the voter. Similarly, an attack that delays postingof codes is subject to detection by the codes being made availableonline by voters before they are officially posted. Accordingly, onlineposting of positions on the forms is believed to verifiably trackphysical filling of the form and thus provide a substantially real-timepublic counter.

In some examples the farm is filled to include a voter signature and/orother voter information per position. In other examples, a position onthe form refers to an entry in a poll book. For instance, a line-numberor a sticker from a corresponding entry in a manual poll book istransferred to the position on the form.

The codes printed are preferably committed to in advance of the electionin a way that can preferably be verified by opening them as they areused or at least afterwards. For example, each code occurs encrypted ina corresponding position in a table that is published and thecorresponding keys are revealed as each code is revealed.

Turning now to FIG. 23A-B, exemplary embodiments of scratch-off pairedcheck-in farms in accordance with the teachings of the present inventionare shown. FIG. 23A shows the form unfilled; FIG. 23B the form partlyfilled. Next to each position, of which only three are shown in theexample for clarity, there are two exemplary scratch-off regions, shownas black approximate ovals. The dotted lines are for the votersignatures, provisions for other information, such as name and/oraddress, not being shown for clarity. The positions are numbered;however, unnumbered forms and/or partially numbered forms are alsoanticipated.

Referring now to FIG. 23B, the form of FIG. 23A is shown at a laterstage with two voters having signed their names. Each voter haspreferably chosen one of the ovals to scratch-off, and the correspondingcodes have been revealed and optionally recorded by voters. The firstvoter, for instance, has signed on line one and chosen the oval on theleft to open, revealing the code 5RJ. The second voter obtained thesecond code 9P8.

Turning now to FIG. 24A-B, exemplary embodiment of invisible-ink pairedcheck-in forms in accordance with the teachings of the present inventionare shown. FIG. 24A shows the form unfilled; FIG. 24B shows it partlyfilled. In place of the scratch-off ovals described already withreference to FIG. 23, the present figure shows printed ovals thatcontain indicia in invisible ink, such as already described withreference to FIGS. 5 and 12, as mentioned. Thus, in the blank form ofFIG. 24A the ovals are shown empty; but in the partly-filled form ofFIG. 24B, the ovals selected are shown with pen marks over them and thecode indicia 3X7Q and R3Q2, respectively, developed within.

Referring now to FIG. 25A-B, combination block-diagram and flowcharts ofexemplary embodiments of a voter-verifiable counter system in accordancewith the teachings of the present invention are shown. Referring to FIG.25A, the codes are created 2501, encrypted 2503, and posted 2505. Insome examples the codes are created at random; in others, they arecreated pseudorandomly, such as cryptographically from a key. Similarly,the keys used to encrypt each are in some examples random and in otherspseudorandom, as would be understood. Whatever arrangement to make thecodes substantially difficult to guess and substantially verifiablycommitted to would be suitable. The posting 2505 preferably makes thecommitments to the codes public.

Referring finally now to FIG. 25B, the use of a form in avoter-verifiable counter system is shown in a combination block-diagramand flowchart in accordance with the teachings of the present invention.For each voter, the three steps shown are repeated, according to repeatblock 2520. The voter fills the next position on the form 2522, or theposition on the form is filled for the voter. Preferably the positionsare at least partly numbered as described and are filled in order. Next,the choice between the plural hidden codes, two in the example, ispreferably provided to the voter 2524. In other examples it is formed atrandom by a physical experiment, such as the flipping of a coin. Howeverit is determined, the voter preferably has some influence on the choice.In a scratch-off type system, the region chosen has its protectivecoating removed; in an invisible-ink type of system, the ink activatoris applied to the selected region. Finally, the decrypted or opened codeis published 2526.

All manner of variations, modifications, equivalents, substitutions,simplifications, extensions, and so forth can readily be conceivedrelative to the present inventions by those of ordinary skill in theart. One example, as will be appreciated, is where ballots are mailedout to voters and returned by voters. Another example is where ballotsare considered provisional, including optionally vote-by-mail ballots,and affidavits in effect point to or determine the particular recordedcodes corresponding to the votes so that the votes can then beselectively included or excluded from one or more tallies.

While these descriptions of the present invention have been given asexamples, it will be appreciated by those of ordinary skill in the artthat various modifications, alternate configurations and equivalents maybe employed without departing from the spirit and scope of the presentinvention.

1-26. (canceled)
 27. A printing method comprising printing with aninvisible ink and a dummy ink, in which each of a pattern of areas areprinted using at least one of the invisible ink and the dummy ink perarea so as to hide the choice of areas printed in invisible inksubstantially until the areas are developed with a cooperating markingmeans and differences in the areas printed in the invisible ink and thedummy ink revealing information when so developed.
 28. A documentscanning system, comprising paper forms including mark positions andimage processing such that all mark positions on the form, such markpositions being made up of marked mark positions and un-marked markpositions, are each recognized in image processing and each recognizedposition is further recognized as marked or unmarked.
 29. The documentscanning system according to claim 28, wherein marked positions compriseregions and the regions are pre-printed with indicia distinct fromindicia printed elsewhere on the form.
 30. The document scanning systemaccording to claim 28, wherein the mark positions are pre-printed withdistinct values and image processing including obtaining a value from atleast an un-marked mark position by a scanning portion of a system andthe value substantially unknown to the scanning portion of the systembefore obtaining it from the form.
 31. The document scanning systemaccording to claim 28, wherein the mark positions are pre-printed withdistinct first values and second values and the first values visiblebefore marking and not after marking and the second values visible aftermarking and not before marking and image processing including obtaininga first value from an un-marked mark position by a scanning portion of asystem and obtaining a second value from a marked position by a scanningportion of the system and the values substantially unknown to thescanning portion of the system before obtaining the values from theform.